Aha Trivia Stuff Everyone Should Know

Free practice tests · Tech, AI & Security

Phishing Training: Spot Scam Emails, Calls and Fake Links

Stuff Everyone Should Know About Phishing & Scams

Spot phishing emails, scam calls, fake links and QR codes before they cost you. Security awareness in quick 30-second cards.

Start Stuff Everyone Should Know About Phishing & Scams ⚡ Today's sprint 🎙️ Voice mode

🔗 Put this game on your site

Free. It plays the first 50 cards; players subscribe at Aha Trivia for the rest. Every embed code

📖 Read or print the training guide

Free to start, no sign-up. 127 cards so far. One Knowledge Score and day streak across all your courses.

Questions people ask

Is this practice test free?

Yes. The first 50 cards are free for everyone with no sign-up, each with the answer, why it is right and its sources. Aha Trivia members get all 127 cards and timed practice exams.

How many practice questions are there?

127 practice questions so far. Each one is a 3-choice card that takes about 30 seconds, and the course grows as new cards pass our source checks.

Where do the answers come from?

Every card lists the sources it was checked against, and each answer explains why it is right. If you think an answer is wrong, tap "Challenge this answer" in the game and it gets reviewed.

Can I study in the car?

Yes. Voice mode reads the questions out loud and you answer by voice.

Try 3 cards

  1. Is a password enough?
    Show the answer

    No, add a second factor, like a passkey. Any second factor stops most account hacks. A text code is good, an authenticator app is better and a passkey is best.

  2. A caller says you owe money and must pay right now with gift cards. Which of these would ever ask you to pay that way?
    Show the answer

    None of them, ever. No real business or government agency will ever tell you to buy a gift card to pay them. Anyone who asks for the numbers off the back of a card is a scammer. If it already happened, keep the card and the receipt and report it to the gift card company right away.

  3. A pop-up says 'Microsoft Alert: Virus found! Call this number now.' What's true?
    Show the answer

    It's fake: real Microsoft warnings never include a phone number. Microsoft's real warnings never include phone numbers, and Microsoft won't call you to fix your computer unless you asked. Scammers make scary pop-ups that seem to lock your browser so you'll call them. Then they try to get into your computer and charge you for fake repairs.

All 127 practice questions

The first 50 are free, with the answer, why it's right and the official sources. The other 8 (🔒) open with a membership (every test). Or play them as a game and track what you've learned.

Show all 127 questions
  1. Is a password enough?
  2. A caller says you owe money and must pay right now with gift cards. Which of these would ever ask you to pay that way?
  3. A pop-up says 'Microsoft Alert: Virus found! Call this number now.' What's true?
  4. There's a QR code sticker on the parking meter. What's the smart move before you pay?
  5. Is it okay to check your bank account on coffee shop Wi-Fi?
  6. Grandma gets a call that sounds exactly like her grandson: he's in trouble, needs money now, and says not to tell Mom. What should she do first?
  7. A text says your bank account is locked. How should you check?
  8. Does a familiar caller ID prove who is calling?
  9. An unwanted sales robocall offers a button to stop calls. What should you do?
  10. A scammer got your password. What about other accounts using that same password?
  11. A caller says you won a vacation but must pay a fee first. What should you do?
  12. Why install phone software updates even when you do not want new features?
  13. A website shows a padlock and https. What does that tell you?
  14. Which message style is a phishing warning sign? 🔒
  15. What can reveal a phishing link? 🔒
  16. Why can a WebAuthn passkey resist a lookalike site's login prompt? 🔒
  17. What separates phishing from an ordinary unwanted message? 🔒
  18. A phishing email lands in your inbox. The FTC says to forward it to which group?
  19. You get a scam text. What number does the FTC say to forward it to?
  20. An email says your payment failed and gives a link to update your card. What is the FTC's rule?
  21. A message claims to be from your bank. What is the safest way to check whether it is real?
  22. An email includes an invoice you do not recognize and asks you to click to pay. What does the FTC say?
  23. CISA gives amazan.com as an example of what phishing red flag?
  24. An email has perfect spelling and grammar. What does CISA say that tells you?
  25. Why does CISA call untrusted shortened URLs a phishing warning sign?
  26. A suspicious email has an 'unsubscribe' link. What does CISA say to do?
  27. A message says 'respond within 24 hours or lose access.' Which NCSC scam sign is that?
  28. An email offers hard-to-get concert tickets, but only a few are left. Which NCSC scam sign is that?
  29. Someone says you must pay a bill, fine or fee with gift cards. Who does that?
  30. A text from 'your boss' asks you to buy gift cards for clients and send the codes. Best first move?
  31. You already sent gift card codes to a scammer. What does the FTC say to do right away?
  32. Per the FTC, when might a scammer already have a gift card's number and PIN?
  33. A caller claiming to be tech support wants you to install software. What are they after?
  34. Someone calls saying they are Microsoft Support and your PC has a virus. What does Microsoft advise?
  35. You let a fake tech support caller into your PC. What does Microsoft say to do?
  36. A caller says they are from Apple Support and your account was hacked. Apple's advice?
  37. A caller sounds exactly like your relative and begs for money. What does the FTC say?
  38. How much audio does the FTC say a scammer needs to clone someone's voice?
  39. The FBI suggests setting up what with your family to check identities during a scary call?
  40. Your 'CEO' joins a video call and urgently asks for a wire transfer. What does the FBI warn?
  41. Someone contacts you asking for the two-factor code just sent to you. Per the FBI, who can you give it to?
  42. How hard does the FBI say AI-generated audio is to identify?
  43. A vendor emails new bank details for the next payment. What does the FBI advise?
  44. You wired money to a fraudster's account. What does the FBI say to do right away?
  45. An email 'from an employee' asks HR to change their direct deposit account. What is this?
  46. Microsoft says business email compromise targets businesses that frequently do what?
  47. In the FBI's IC3 report for 2025, about how much did business email compromise cost victims?
  48. Scammers sometimes cover real QR codes on things like what, per the FTC?
  49. An unexpected email contains a QR code asking you to sign in. What does the FTC say?
  50. What is QR code phishing called, and where might the QR code hide?
  51. A 'bank agent' says move your money to a safe account because a hacker is in. What do you do?
  52. You deposit a check and the money shows in your account. Does that mean the check is good?
  53. Someone insists you can only pay by wire, crypto, a payment app or gift card. What does the FTC say?
  54. A text says your account is locked and asks you to reply with your details. FTC advice?
  55. A robocall offers 40 to 50 percent off your phone or TV bill if you pay with gift cards. What is it?
  56. You clicked a link in a scam message and may have installed software. What does the FTC say?
  57. A scammer got your Social Security or bank account number. Where does the FTC send you for a recovery plan?
  58. You entered your password on a phishing page. What does Microsoft say to do immediately?
  59. In Outlook, how do you report a message as phishing?
  60. Google says Gmail will never ask you to send what over email?
  61. Microsoft Learn says not to open attachments or links in unsolicited emails, even if they came from whom?
  62. CISA says employees need phishing training how often?
  63. CISA says a strong business password should be at least how long?
  64. How many accounts should each password be used for, according to CISA?
  65. What does current NIST guidance say about forcing symbols and capital letters in passwords?
  66. Does NIST say companies should force staff to change passwords on a schedule?
  67. NIST says a password used as the only login factor should be at least how long?
  68. Should a login page let you paste a password, according to NIST?
  69. The UK NCSC suggests combining what to make a strong, memorable password?
  70. How does a password manager help against a fake login page?
  71. Which password habit does the FTC say should be against company policy?
  72. A new router or app ships with a default password. What should you do first?
  73. Which kind of MFA does CISA call the gold standard?
  74. CISA says the only widely available phishing-resistant sign-in method is what?
  75. What is push bombing, also called MFA fatigue?
  76. With number matching in Microsoft Authenticator, how do you approve a sign-in?
  77. Which sign-in method does CISA list as vulnerable to phishing?
  78. An account only offers text message codes for two-step verification. What does NCSC say?
  79. How does NCSC say passkeys differ from passwords?
  80. Who can open a SharePoint or OneDrive 'Anyone' link?
  81. Someone forwards your 'Anyone with the link' share. What happens to access?
  82. Which SharePoint and OneDrive link type does Microsoft call the most restrictive?
  83. If admins turn off external sharing, guests typically lose access within how long?
  84. What does an External label on an Outlook email tell you?
  85. Microsoft emails you about an unusual sign-in. What should you do?
  86. CISA says to turn on what so devices install updates without your input?
  87. CISA says to install all updates, especially for which two things?
  88. A 'restart to update' reminder appears. When does CISA say to install updates?
  89. Why does the FTC now say connecting through public Wi-Fi is usually safe?
  90. Before choosing a VPN app, the FTC says to check what about your data?
  91. What does the FTC suggest to lock employee computers after a period of inactivity?
  92. What should staff never do with files or devices holding sensitive data, per the FTC?
  93. Where should sensitive paper files be kept when you are not using them?
  94. The FTC says which devices should use encryption if they store sensitive data?
  95. CISA says to keep which kind of backups of critical data?
  96. What should you do regularly with your backups, according to CISA?
  97. What do many ransomware variants try to do to backups they can reach?
  98. What does NCSC say to turn on to protect your online backups?
  99. CISA's ransomware guide says not to expose which service directly to the internet?
  100. One FTC principle for protecting customer information is to keep only what?
  101. The FTC's last principle for protecting customer data is to create a what?
  102. Where should a work laptop never be left, according to the FTC?
  103. A work laptop is stolen. What does BitLocker drive encryption help protect against?
  104. You remotely erase a lost Android phone, then find it. What do you need to use it again?
  105. What does Lost Mode do on an Apple device?
  106. What should every employee know, according to the FTC?
  107. Microsoft says Copilot Chat prompts under enterprise data protection are not used to do what?
  108. Google says a subset of Gemini Apps chats may be read by whom?
  109. How often does NCSC suggest reviewing who has access to important accounts?
  110. You find an unknown USB drive in the office hallway. What does CISA say to do with it?
  111. Can you use your personal USB drive on a computer your employer owns? What does CISA advise?
  112. You step away from your Windows PC for a minute. Which shortcut locks it instantly?
  113. In a coffee shop, a stranger watches your screen as you type your password. What does CISA call this?
  114. Visitors at your office want Wi-Fi. What does CISA suggest giving them?
  115. You share a OneDrive 'Anyone' link for a one-week project. Which link setting stops it working afterward?
  116. Which is a common warning sign of a phishing message? 🔒
  117. Tricking a person into revealing information or taking a harmful action is called what?
  118. What is phishing called when it targets a specific person, company or industry?
  119. Phishing carried out over a phone call is commonly called what?
  120. A text with a link asks you to update your payment info. What is it likely? 🔒
  121. Which HIPAA security awareness topic covers phishing emails? 🔒
  122. Leah gets an email asking her to log in to a strange link to keep her account. What should she do? 🔒
  123. On a Windows PC, a fake virus pop-up traps your browser. How can you close it without touching the pop-up?
  124. An online sweetheart you have never met asks for emergency money. What should you do?
  125. After scanning a QR code, what should you check before opening the link?
  126. A simple game wants your contacts, photos, and location. What is the privacy-smart response?
  127. You changed a new router's Wi-Fi password. Which other default password may still need changing?